CVE-2026-79515: n/a
Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 10/24/2026, 22:16:05 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 33% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:RWhat to do
AI-suggested
Until a fix is available, avoid processing untrusted or suspicious TTF files with the affected component to mitigate risk.
Description
CVE-2026-79515 is an out-of-bounds read vulnerability in the stbtt_GetGlyphShape component of nothings stb library (commit 31c1ad3). This flaw allows an attacker to cause a Denial of Service (DoS) by sending a specially crafted TrueType Font (TTF) file. The vulnerability has a medium severity rating with a CVSS score of 4.3. No affected versions or patches are explicitly stated in the available data.
Impact
Successful exploitation results in a Denial of Service (DoS) condition due to an out-of-bounds read. There is no reported impact on confidentiality or integrity. The attack requires user interaction and can be performed remotely without privileges.
Summary
An out-of-bounds read occurs in the stbtt_GetGlyphShape function of the nothings stb library at commit 31c1ad3. This vulnerability can be triggered by processing a crafted TTF file, leading to a Denial of Service condition. The CVSS 3.1 vector indicates that the attack requires low complexity, no privileges, and user interaction, with no impact on confidentiality or integrity. There is no information on available patches or fixed versions.
Weaknesses
- CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.